Safe
libGLESv2.dll is a legitimate OpenGL ES graphics library with no malicious detections across 71 engines and common prevalence; process-injection heuristic is expected graphics-driver behaviour.
9b203e40323b49dad2…e23ba847d4The verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
libGLESv2.dll is a canonical graphics library from the Khronos Group OpenGL ES standard. The file shows no malicious detections (0/71 engines), with 17 high-trust engines explicitly reporting it clean. Its prevalence is common_old (2,962 submissions, 2,430 unique sources), indicating it is an established, widely-distributed commodity file. The triggered 'ProcessInjection' heuristic (T1055) reflects legitimate graphics-driver behaviour: graphics DLLs routinely inject themselves into application processes to provide rendering services. PE analysis shows normal entropy and no packing. No sandbox malicious verdict, no malicious host contact, no dropped malicious children, and no external YARA or CIRCL hits. The combination of universal tier-1 silence, high prevalence, and legitimate graphics-library function strongly indicates this is a benign file.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
tier1Malicious=0; tier1ReportedClean=17 (Avast, BitDefender, Kaspersky, ESET-NOD32, Fortinet, Ikarus, DrWeb, F-Secure, GData, Emsisoft, Avira, AVG all undetected)
prevalence.classification='common_old' — 2430 unique submitters, 2962 submissions since 2025-06-06; established commodity file
Filename 'libGLESv2.dll' is the canonical OpenGL ES 2.0 graphics library (Khronos Group standard); no brand mismatch
triggeredHeuristics: 'MalwareTips.Synth.ProcessInjection' fired on T1055, but rundll32 injection is expected for graphics DLLs; PE entropy normal (6.41 .text, 5.73 .rdata), no packing
behaviour.hasMaliciousSandboxVerdict=false; no malicious contacted hosts, no dropped malicious children, no external YARA/CIRCL hits
- All 17 tier-1 antivirus engines report the file clean (Avast, BitDefender, Kaspersky, ESET-NOD32, Fortinet, Ikarus, DrWeb, F-Secure, GData, Emsisoft, Avira, AVG, and others)
- Prevalence: common_old classification with 2,962 submissions from 2,430 unique sources over 369 days
- Filename matches canonical OpenGL ES 2.0 library (Khronos Group standard)
- PE analysis: normal entropy, no packing, no high-entropy code
- Sandbox execution shows legitimate OpenGL ES export functions, not obfuscated malware
This file is safe. It is the standard OpenGL ES graphics library used by graphics drivers and 3D applications. No action is required unless you have specific concerns about its source.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- \Device\ConDrv\\Connect
- \Sessions\1\BaseNamedObjects\Local\SessionImmersiveColorMutex
YARA + heuristic rules that fired
A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.
MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.
Evidence"C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\Desktop\init.dll",#1
0 detections across 75 engines
Section entropy & packers
Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.
How often this file shows up in the wild
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Forensic fingerprint
- File name
- libGLESv2.dll
- Size
- 5.17 MB
- MIME type
- (unknown)
- Detected type
- Win32 DLL
- SHA-256
- 9b203e40323b49dad29546a52b8b67d200bba8ff4cab9709a79cede23ba847d4
- MD5
- 11a4a07f31e4a91fff678c019b7736af
- SHA-1
- 9912e11aa9c351be136474e0d0975e7964b1e124
- PE imphash
- 39e0b47d01cae06f42d925fb79045509
- First seen (VT)
- 6/6/2025, 2:53:53 AM
- Last analysis (VT)
- 6/8/2026, 11:39:43 AM
- First scan (MalwareTips)
- 6/10/2026, 9:35:40 AM
- Last scan (MalwareTips)
- 6/10/2026, 9:35:40 AM
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.